fix(agent): the cycle line counts rail vetoes and names the rail (#812)

[eaitbrahim]

Closes #812.

What changed

render_loop_result in keel/commands/trading.py now ends each cycle line with a vetoed=N token:

before: ... signals=3 blocked=0 entered=0 exited=0
after:  ... signals=3 blocked=0 entered=0 exited=0 vetoed=3 (account_dd_breaker_weekly)

• N counts entries that were evaluated, not placed, and have a non-empty vetoed_by. It is one per entry, not one per rail (the same one-per-entry rule activity.summarise_cycle uses).
• The overlay's blocked still differs from this line's. For one cycle, overlay blocked = line blocked + vetoed + unplaced entries no rail named. Both docstrings now say so; the old summarise_cycle claim that its counts were the line's is corrected.
• Rail names come from one parse. The new guards.rail_name replaces three copies: activity._first_clause, doctor's inline split, and this token's.
• The rail list names each distinct rail once, in first-seen order, using the leading clause of each violation string. The drawdown arithmetic stays in the JSON log. Bare routing-gate tokens such as max_entry_spread are passed through as-is.
• When nothing was vetoed the line prints vetoed=0 with no parentheses, so a missing token never has to be read as zero.
• Existing tokens keep their meaning and order. keel-live-run.sh greps only signals=[0-9]+.

Out of scope

• vetoed= counts entries only. A rail-vetoed exit (for example base_balance refusing a sell) still prints exited=0 with no reason. None has happened in any log yet.
• An unplaced entry with an empty vetoed_by (a paper no-fill, a declined confirm) is still not shown on the line. It isn't a rail veto, and adding it would mean choosing a separate token.

Verification

• Wrote 4 tests first and confirmed they failed on the missing token. They compare the exact line or its exact tail, not substrings.
• Mutants for "an empty vetoed_by counts as a veto", "count per rail", and "no dedupe" were each applied and each killed.
• The cycle-line tests pair each entry result with its signal, as run_once does, so the FET test pins the real line, signals=3 … vetoed=3. guards.rail_name has its own parametrised test.
• Full suite: 6684 passed, 3 skipped. ruff check, ruff format --check and mypy are clean.

🤖 Generated with Claude Code